| jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (SSRF)CVE-2026-54514 · GHSA-HGJ6-7826-R7M5 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows arbitrary class instantiationCVE-2026-54512 · GHSA-J3RV-43J4-C7QM |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
High
|
Fix reported |
|
| Google Guava: CompactHashMap/CompactHashSet/MapMakerInternalMap deserialization triggers uncontrolled memory allocationCVE-2026-102554 · GHSA-XXPH-C9WW-HJ94 |
com.google.guava:guavaExploit Intelligence/exploit-intelligence/vulnerability-analysis-rhel9 |
MavenRed Hat |
High
|
Fix reported |
|
| jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserializationCVE-2026-59889 · GHSA-5GVW-P9QM-JGWH |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory ExhaustionCVE-2026-48043 · GHSA-C2GF-V879-257J |
io.netty:netty-codec-http2OpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
Medium
|
Fix reported |
|
| proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnetCVE-2026-90711 · GHSA-JQCG-44MW-7W3H |
proxy-addrAnsible Automation Orchestrator 2026/ansible-automation-platform/automation-orchestrator-ui-rhel9 |
npmRed Hat |
Critical
|
Fix reported |
|
| Camel-CXF and Camel-Knative Message Header are Vulnerable to Injection via Missing Inbound FilteringCVE-2026-47323 · GHSA-8364-HFQJ-PWM6 |
org.apache.camel:camel-cxf-restOpenShift Serverless/openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9 |
MavenRed Hat |
Critical
|
Fix reported |
|
| jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)CVE-2026-68494 · GHSA-R7WM-3CXJ-WFF9 |
com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core |
MavenRed Hat |
High
|
Fix reported |
|
| jackson-core: ReDoS: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber()CVE-2026-89407 · GHSA-P6PP-M3F8-5C89 |
com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core |
MavenRed Hat |
High
|
Fix reported |
|
| jackson-core: UTF8DataInputJsonParser._reportInvalidToken() missing maxErrorTokenLength limit -> unbounded StringBuilder growth (DoS)CVE-2026-89425 · GHSA-7HHH-6RMP-J9QF |
com.fasterxml.jackson.core:jackson-coretools.jackson.core:jackson-core |
MavenRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to inconsistent host case normalization via percent-encoded octetsCVE-2026-86472 · GHSA-HRR3-GC8F-F4QJ |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
Medium
|
Fix reported |
|
| fast-uri vulnerable to authority injection via an unvalidated port in serializeCVE-2026-84292 · GHSA-QW65-CVWX-89V3 |
fast-uriMulticluster Engine for Kubernetes/multicluster-engine/console-mce-rhel9 |
npmRed Hat |
High
|
Fix reported |
|
| fast-uri vulnerable to host confusion via an unclosed bracket in the URI authorityCVE-2026-84394 · GHSA-58MR-GQGX-XQ4G |
fast-uriCost Management On Premise/costmanagement/costmanagement-ui-rhel10 |
npmRed Hat |
High
|
Fix reported |
|
| jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)CVE-2026-83557 · GHSA-GX83-3VF8-GH7J |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoSCVE-2026-68497 · GHSA-Q4XH-88C3-WMH7 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
High
|
Fix reported |
|
| jackson-databind: Path Deserialization Missing Scheme Allowlist for FileSystemProvider ResolutionCVE-2026-19032 · GHSA-WJGM-6HV5-3CVF |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| jackson-databind: Incomplete fix for CVE-2026-54514: eager DNS resolution (SSRF) still present in InetAddress deserializationCVE-2026-77310 · GHSA-VVGP-RFG2-7RR6 |
com.fasterxml.jackson.core:jackson-databindtools.jackson.core:jackson-databind |
MavenRed Hat |
Medium
|
Fix reported |
|
| Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory ExhaustionCVE-2026-48059 · GHSA-H2QV-FJ59-J46J |
io.netty:netty-codec-haproxyOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
High
|
Fix reported |
|
| Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME RecordsCVE-2026-45674 · GHSA-676X-F7GG-47VC |
io.netty:netty-resolver-dnsOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
High
|
Fix reported |
|
| Netty has Insufficient Bailiwick Validation for NS RecordsCVE-2026-47691 · GHSA-5PVG-856G-CP85 |
io.netty:netty-resolver-dnsOpenShift Serverless/openshift-serverless-1/kn-ekb-dispatcher-rhel9 |
MavenRed Hat |
High
|
Fix reported |
|
